Registering with the competent authority: how does it work?
Organizations that fall under the NIS2 Directive as essential or important entities must register themselves with the national competent authority. This is done through a portal set up by the competent authority, providing information about your organization, your contact persons, and the services you provide. You will not receive a letter reminding you to register: the obligation to register rests with the organization itself, not with the competent authority to track you down.
This last point surprises many management teams. With other regulatory obligations — a license, an annual declaration — you often receive a notification from the authority itself. With the registration obligation under the Dutch Cybersecurity Act, it works the other way around: the competent authority does not initially know which organizations fall under the law, and therefore depends on your own assessment and action.
What information is requested
The registration typically requests identifying information about the organization, such as the name, the trade register number, and the address, supplemented by the sector and the activity under which you fall within the law. In addition, you will be asked to provide one or more contact persons whom the competent authority can reach, with name, telephone number, and email address — these are often different persons from a standard business contact, because the focus is on reachability in the event of an incident. The network and information systems or services relevant to the classification as essential or important, and sometimes the member states in which you provide services, are also part of the picture the competent authority wishes to obtain.
The exact fields and the layout of the form differ by country, because each member state transposes the directive into its own national legislation and the competent authority itself sets up the portal. What is requested in the Netherlands does not necessarily correspond one-to-one with what a competent authority in another country asks of a subsidiary there.
Why you don't receive a letter
The registration obligation is designed as an obligation of the organization, not as an invitation from the government. At the start of the law, the competent authority does not have a complete list of who is active where and falls below which threshold — that information must come from the sector itself. This is similar to how a business register entry or a VAT return works: the responsibility to act on time rests with the entrepreneur, even though no one sends a reminder.
For many small and medium-sized enterprises affected through the supply chain, this does not apply anyway: only essential and important entities themselves have a registration obligation. Businesses that only receive a security questionnaire from a customer that does fall under the law do not register themselves with the competent authority. Whether your organization falls into the first or the second group is not always immediately clear; in a few questions, see where your organization stands provides initial guidance on this, with an explanation for each outcome.
When to register
The national law determines the timeframe and the moment from which an organization must register after it qualifies as essential or important. These timeframes are set out in the national transposition of the directive and on the website of the competent authority itself, and they may change as the legislation is further developed. For the current status, you should consult the competent authority or a legal adviser, not a general article — a change to the competent authority's website or an announcement is authoritative on this point, not a date stored somewhere.
What secria.eu does and does not do with regard to registration
The platform helps you prepare the text and data you need to complete the registration form: which contact persons you must provide, which sector and activity description aligns with how the regulator categorizes, and what substantiation supports the classification. What it explicitly does not do is submit on your behalf. You submit yourself at your regulator's portal; secria.eu prepares the text, you place it. How that preparation is produced and which sources are used is explained on the page on how the information is compiled.
Doubt about your own situation
Whether and when registration applies to your organization depends on the sector in which you operate, the size of your organization, and the national law applicable to you. That is not a question one general article can answer for your specific situation; for that, the competent regulator or a lawyer is the appropriate contact. Frequently asked practical questions about registration, reporting obligations, and the role of suppliers are collected on the frequently asked questions page.
Would you first like an overview of all topics around the NIS2 Directive and the Cybersecurity Act, from sector classification to the ten management measures? You will find that, tailored to your situation, on the overview page with all topics. And if you do not yet know whether registration applies to you, the free quick-scan is the fastest first step to get clarity on that.